eIDAS 2.0 and the EU Digital Identity Wallet: What Changes for Signing

The reform that everyone half-heard about

If you sign with European counterparties, you have probably seen "eIDAS 2.0" mentioned and quietly worried you missed a rule change that breaks your signing process. You almost certainly didn't. The 2024 reform is real and significant, but it is far more about identity than about signatures, and it changes nothing you are already doing correctly. The three signature tiers you rely on today are untouched.

This is a plain map of what actually changed, what the new EU Digital Identity Wallet is, and how it could — over the next few years — make the strongest tier of electronic signature dramatically easier to obtain. It builds directly on the tiers explained in eIDAS: signing across borders in Europe; if you haven't read that, start there, because everything below sits on top of it. This is general guidance, not legal advice.

What eIDAS 2.0 actually is

The original eIDAS — Regulation (EU) 910/2014 — gave Europe a common framework for electronic identification and trust services, including the three signature tiers (SES, AES, QES). In 2024, Regulation (EU) 2024/1183 amended it, establishing the European Digital Identity Framework. This is what people mean by "eIDAS 2.0." It entered into force in May 2024, and its centerpiece is a requirement that every EU member state make an EU Digital Identity Wallet available to its citizens and residents, with the wallets rolling out over the following years.

The crucial thing to understand: eIDAS 2.0 did not redefine what a Simple, Advanced, or Qualified Electronic Signature is. Those definitions, and their legal effects, carry forward. What it added was a new, standardized, cross-border way for a person to prove who they are — and, importantly, a channel through which they can obtain and use a qualified signature far more easily than before.

What the EU Digital Identity Wallet is

Think of the wallet as a government-recognized identity app on a citizen's phone. It is designed to hold verified identity data and electronic attestations of attributes — credentials like a driving licence, a diploma, a professional qualification, or proof of age — issued by trusted sources, which the holder can then present selectively to whoever needs them.

Two properties make it relevant to signing:

It is cross-border by design. A wallet issued in one member state must be recognized across all of them — the same mutual-recognition principle that already makes a QES valid EU-wide, now extended to identity itself.
It can provision a qualified signature. The regulation contemplates wallets enabling their holders to sign with a Qualified Electronic Signature, free of charge for natural persons in a non-professional capacity. In other words, the wallet aims to put the top signature tier — historically the most cumbersome to obtain — directly in an ordinary citizen's pocket.

That second point is the quiet revolution. The reason most international commercial signing sensibly defaults to AES rather than QES today is friction: obtaining a QES has meant working through a qualified trust service provider with identity vetting that few routine transactions justify. If the wallet delivers on its promise, that friction drops, and a QES becomes a realistic option for a much wider set of documents.

What this changes for how you sign — and what it doesn't

For the vast majority of business signing, the practical answer for now is: nothing you must do differently today. Your defensible defaults hold:

A Simple or Advanced Electronic Signature remains valid and sufficient for the large majority of commercial agreements. eIDAS 2.0 does not raise the bar you must clear.
The legal validity of what you sign today is unaffected — a signature valid before the reform is valid after it.
Your obligations around the personal data you collect when someone signs are still governed by GDPR, a separate question the wallet does not answer for you.

What is genuinely worth watching:

Wallet adoption is phased and uneven. Member states are rolling wallets out on their own timelines, and real-world availability among your counterparties will lag the regulation for some time. Do not assume a European signer has a wallet yet; most still won't for a while.
Identity verification may get easier and stronger. Where a signer does present a wallet, you gain a high-assurance way to confirm they are who they claim — an upgrade to the identity-verification step that today relies on email links, access codes, or SMS. That is the direction of travel: identity proof becoming a first-class, portable credential rather than something each platform reinvents.
QES becomes a "when it's worth it" choice, not a "too hard to bother" one. As wallet-provisioned qualified signatures spread, reserve QES for the documents where law or risk truly demands it — but expect the calculus to shift as the friction falls.

What a sensible business does now

Don't panic, and don't re-paper anything. No existing signature is invalidated, and your current defaults remain sound.
Keep AES as your international default for commercial agreements, exactly as before, and treat QES as the deliberate exception for high-stakes or legally-mandated documents.
Watch wallet availability in the countries you actually deal with. The reform matters to you when your counterparties start carrying wallets — track that, not the headline.
Choose a platform that can evolve with identity. When you evaluate a signing platform, favor one whose verification model can adopt stronger, portable identity proof as it becomes available, rather than one welded to a single method.

The takeaway

eIDAS 2.0 is an identity reform wearing a signature-shaped headline. It leaves the SES/AES/QES tiers and their legal effects intact, so nothing you sign correctly today becomes wrong tomorrow. What it adds is the EU Digital Identity Wallet — a cross-border, government-recognized way for people to prove who they are and, in time, to obtain a qualified signature with far less friction than before. For now, keep your sensible defaults, keep GDPR firmly in a separate box, and watch wallet adoption among the counterparties you actually work with. The change to prepare for is not a new rule to obey — it is identity verification quietly getting stronger, and a qualified signature quietly getting easier. See how signer verification works today or start free.

This article is general guidance on European electronic-signature and identity regulation, not legal advice. eIDAS 2.0 implementation and wallet availability vary by member state and are still rolling out; confirm your position for any specific cross-border transaction with qualified counsel.

eIDAS 2.0 and the EU Digital Identity Wallet: What Changes for Signing

The reform that everyone half-heard about

What eIDAS 2.0 actually is

What the EU Digital Identity Wallet is

What this changes for how you sign — and what it doesn't

What a sensible business does now

The takeaway

See Hosting Sign in action

Related articles

QES vs AES vs SES: The Three Levels of Electronic Signature Under eIDAS

E-Signatures and GDPR: Lawful Basis, the DPA, and the Right to Erasure

E-Signatures for Government Contractors: FAR, ESIGN, and What Actually Applies

Related articles

Compliance
QES vs AES vs SES: The Three Levels of Electronic Signature Under eIDAS
European e-signature law does something US law does not: it defines three distinct legal tiers of electronic signature — simple (SES), advanced (AES), and qualified (QES) — each with its own requirements and legal weight. Only one, the QES, is granted the same legal effect as a handwritten signature across the entire EU. Here is what separates the three levels, when each is appropriate, and why most cross-border business never needs the top tier.

Compliance
E-Signatures and GDPR: Lawful Basis, the DPA, and the Right to Erasure
Whether an electronic signature is legally valid and whether the personal data behind it is handled lawfully are two different questions — the first is eIDAS, the second is GDPR. A practical map of the lawful basis you actually rely on, why signing consent is not GDPR consent, the controller/processor split, and how the right to erasure collides with a signed record you are obliged to keep.

Compliance
E-Signatures for Government Contractors: FAR, ESIGN, and What Actually Applies
Government contracting sounds like it should have its own special signing rules — and in a few places it does. But most federal contract documents e-sign under the same law as everything else. A clear map of where FAR touches signatures, where ESIGN carries the day, and what to keep in your file.